Add option to build with control-flow integrity (CFI) enabled (--enable-cfi).
Control-flow integrity (CFI) is a very powerful exploit mitigation technique.
CFI makes it harder for an attacker to redirect the flow of execution of a program.
Like other exploit mitigations (ASLR, DEP, stack cookies, etc.) it reduces the probability of bugs turning into exploits.
Any reason to make this a separate option instead of include it witn default --enable-hardening?
@laanwj My thinking was the could start with --enable-cfi and then move it to --enable-hardening after a while when people have played with it. But perhaps I'm too cautious :-)
Big chance it's already possible to experiment with that without making a special case in the build system.
For ex. if enabling this feature is a matter of enabling a flag to the C compiler, it can be passed using
./configure ... CFLAGS="..." CXXFLAGS="..."
Closing due to lack of interest/progress :)